Target CIO's Resignation: 7 Questions

Pop quiz for discount retailers who suffer a high-profile data breach that impacts millions of customers, weakens sales, shaves a few points off of your stock price, and may cost your company hundreds of millions of dollars to clean up: What happens next?

For Target, that would be the departure of CIO Beth Jacob, who announced Wednesday -- in a letter to Gregg Steinhafel, Target's chairman, president, and CEO -- that she was resigning "effective immediately." The same day, Steinhafel said in a statement that Target planned to make a number of technology, information security, and compliance changes, and to hire an "interim CIO" to oversee that transition.

To be clear, Jacob was in charge of IT for a retailer that fell victim to a hack attack that resulted in 40 million credit and credit cards and personal information on 70 million customers being compromised. But was she unfairly forced out? And does an episode like this mean the end of a CIO's career?

Here are seven related points to consider:

1. Did Target make CIO a scapegoat?
Some people think Target's management team jettisoned Jacob, finding her a convenient scapegoat. "Target has been obviously impacted. People are questioning Target's security. And she was the fall guy," Walter Loeb, a New York-based independent retail consultant, told The Christian Science Monitor.

[For more on Target's shifting management team, read Target Seeks New CIO.]

But for information security industry veteran Ted Julian, who serves as chief marketing officer at incident response firm Co3 Systems, the end of Jacob's Target tenure wasn't a surprise. "Under these circumstances, it's pretty standard, if for no other reason than optically it just shows the company taking action. It allows them to get someone new with some new ideas and enthusiasm and excitement that can be shown to make aggressive changes," he said, speaking by phone.

Still, her post-breach departure was relatively rapid. "It is pretty typical for the CIO to take the fall, though typically not this quickly," Gartner analyst Avivah Litan said, speaking by phone. "The buck typically stops with the CIO, even though it should stop with the CEO."

On the other hand, according to recent studies, a CIO's job tenure lately lasts, on average, about six years. By that measure, Jacob's five years in the job rates as just about the norm.

2. Before the breach: Were warning signs ignored?
One frequent topic of conversation at last week's RSA conference in San Francisco involved a February 2014 Wall Street Journal report that Target staff had warned management that the retailer was at risk of having its POS systems compromised, at least two months prior to the breach.

But more than one RSA panel participant cautioned that it would be the rare information security team that wasn't sounding some types of alerts. The Journal's report also offered no signal-to-noise assessment of what other types of warnings that Target's CIO and senior management team may have received or acted upon.

"For every single breach I've been aware of, the alarms went off, but if you're getting one serious alarm buried in 10,000 or 100,000 alarms, it's hard to pick it out," Litan said. "There's so much noise, it's a lot like the patches on Windows or Internet Explorer -- here's another bug that was discovered, or certificate that was expired. You just get immunity."

Of course, some businesses seem complicit in their data breaches. Sony, for example, laid off most of its security staff in 2011 and was subsequently hacked more than a dozen times. But Target doesn't appear to have skimped on information security. "Here's what we do know: this was not an anemic security department that lacked staff or resources," Co3's Julian said. "That's not to say that maybe they shouldn't have more, but... this looks to be a well-funded, highly competent group, with extensive rapport across Target and the industry."

3. Will IT reboot better secure Target?
Target is now shopping for a new interim CIO and has hired consulting firm Promontory Financial Group to offer technology, staffing, and business process advice for the retailer's IT, information security, compliance, and risk-management reboot.

Instead of splitting information security responsibilities being between several people, Target will also look externally to hire its first-ever CISO as well as its first-ever chief compliance officer. The latter role was previously overseen by Ann Scovil, Target's VP of risk assurance and compliance, who has long planned to retire at the end of this month, the Wall Street Journal reported.

Asked about how the company planned to now handle risk management -- and whether it would designate a chief risk officer -- Target spokeswoman Molly Snyder said via email, "We haven't provided any additional details on that to date."

Figure 1:Former Target CIO Beth Jacob

4. Target's vacant technology jobs: caveat emptor?
In 2008, with the Great Recession gaining force, Jon Stewart famously asked then-presidential candidate Barack Obama: "With the kind of issues that face the country now... is there a sense that you don't want this?"

Might the same cautionary note be sounded for anyone

Next Page

considering CIO, CISO, or chief compliance officer roles at Target? "The moral of this story is, if you're in IT, don't go into retail," said Gartner's Litan. "Although the attackers are going everywhere," she added, noting that the retail industry is hardly the only sector being pummeled.

5. Will payment industry step up to stop POS malware?
Target's technology and risk reorganization aside, Litan said that the relative ease with which attackers can compromise POS systems doesn't only come down to the health of a retailer's information security program. "It's unfair to expect retailers to be able to fight this type of sophisticated malware," she said. "Even the security companies miss this type of malware." Litan continued, "It's really the payment systems themselves that have to change." Don't expect a working solution to the problem unless the payment card industry steps up.

6. Will PCI assessors take responsibility?
Likewise, part of the blame for Target's breach may lie with whichever Payment Card Industry Qualified Security Assessor (PCI QSA) certified Target as being compliant with the Payment Card Industry Data Security Standards (PCI DSS). "What about the QSA? No one ever talks about these PCI assessors," Litan pointed out.

She also criticized PCI assessors for having language in their contracts that precludes them from being held liable if a certified business they've certified as PCI-compliant later suffers a breach. "Why should the assessors escape liability? They're the third-party experts who are certified to achieve PCI compliance -- the CIO never went through PCI certification," Litan said. "That's why this process is so flawed. It's just stacked against the retailers and stacked for the banks and PCI players. They don't lose anything from these breaches, except for public reputation."

7. Life after Target for Jacob?
With Jacob's tenure as Target's CIO finished, will the retailer's data breach ruin her future career prospects? Co3's Julian said that in fact, the opposite will likely be true. "Frankly, it's been proven that the speaker's circuit is a great place -- honestly -- for people to talk about the experience, and lessons learned, and all the rest," he said. "On top of that, often these people end up at a different CIO gig, or at some type of a consultancy, so this is not necessarily career-limiting at all."